✓ProveIt
Examples / Report #3242005 Saved analysis

Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl

curl · 2025-07-0910.2s analysis · $0.013 in model calls

What the report claims

Use-After-Free in OpenSSL keylog callback via SSL_get_ex_data() in libcurl

Compare with curl's recorded outcome

Labeled AI slop

curl's maintainer lists this report as AI slop

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

curl policy: API misuse
Judgment withdrawn. The answer failed the evidence check.
See the withdrawn model reasoning

The following reasoning failed the citation check and does not support the final finding.

  • The reported functions (SSL_get_ex_data, SSL_get_ex_new_index, SSL_set_ex_data, SSL_CTX_set_keylog_callback) are OpenSSL APIs, not libcurl APIs. Deterministic checks confirm they do not exist in curl at the revision checked.
  • The reproduction code is a standalone OpenSSL test program that manually calls the callback after SSL_free() - this is the test program's own misuse, not a callback invoked by the library after free.
  • No curl source code is provided showing a keylog callback integration or a path where curl would invoke a callback after freeing an SSL object.
  • The project policy lists 'API misuse' as not a security issue: issues triggering only by using the API in an undocumented/incorrect way are not considered security problems.
How this analysis ran 5 claims · 3 citations verified

Evidence check: judge quoted an external source that does not say that (https://docs.openssl.org/3.4/man3/SSL_CTX_set_keylog_callback)

Checked against curl master on 2025-07-09 (784c17b7d98c). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
partially grounded
no model · 10 references checked out, 3 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 1818 tokens · $0.0002
3 · Evidence
5 code snippets
real curl source at 784c17b7d98c · 3 docs via Tavily
4 · Judgment
Nemotron-3-Ultra-550b-a55b
8232 tokens · 8.1s · $0.0131
5 · Receipts
3 of 9 citations verified
every citation must point at code the judge was shown
Inspect the withdrawn draft reply

This draft belongs to the withdrawn judgment. It may contain unsupported claims.

The report describes a Use-After-Free in OpenSSL's keylog callback API, not in libcurl. The functions SSL_get_ex_data, SSL_get_ex_new_index, SSL_set_ex_data, and SSL_CTX_set_keylog_callback are OpenSSL APIs and do not exist in libcurl at the revision checked. Your reproduction program calls OpenSSL directly and manually invokes the callback after SSL_free() — this is API misuse in the test code, not a libcurl flaw. Please verify whether the issue occurs when using libcurl's public API (e.g., curl_easy_setopt with CURLOPT_SSLKEYLOGFUNCTION) and provide a reproduction using libcurl if so.

Inspect all claims and source code 5 claims · 5 code excerpts

This model judgment was withdrawn. The claim assessments below are preserved for inspection and may be wrong.

Report claims

C1flaw contradicted

Use-After-Free in OpenSSL keylog callback via SSL_get_ex_data() in libcurl

Read the reasoning

The report claims a UAF in libcurl via SSL_get_ex_data(), but the deterministic checks confirm that SSL_get_ex_data, SSL_get_ex_new_index, and SSL_set_ex_data do not exist in curl at the revision checked (master on 2025-07-09). The reproduction code uses OpenSSL APIs directly, not libcurl. The flaw described is in OpenSSL usage, not in libcurl code.

lib/setup-vms.h:289 deterministic check
C2location contradicted

SSL_CTX_set_keylog_callback

Read the reasoning

While SSL_CTX_set_keylog_callback appears in deterministic checks as grounded, the provided curl source only shows macro definitions. The keylog callback is an OpenSSL feature documented in external sources E1-E3. The report's reproduction code calls OpenSSL directly, not through libcurl.

deterministic check lib/setup-vms.h:276
C3trigger contradicted

SSL object is freed via SSL_free() and then the keylog callback is invoked

Read the reasoning

The trigger described requires the keylog callback to be invoked after SSL_free(). In the reproduction code, the callback is manually called by the test program after free, not invoked by the library. This is API misuse in the test program, not a library flaw. No curl code path is shown where curl invokes a keylog callback after freeing an SSL object.

lib/setup-vms.h:289 report_reproduction_code:0
C4impact not verifiable

segmentation fault (DoS); possible code execution via heap grooming or ex_data abuse

Read the reasoning

The impact (segfault, possible code execution) is demonstrated only in the reporter's test program that misuses OpenSSL API. Since the flaw is not in curl code, the impact on curl is not verifiable from provided evidence.

report_reproduction_code:0
C5reproduction contradicted

Run the provided minimal C program that registers a keylog callback, sets ex_data, frees the SSL object, and then calls the callback

Read the reasoning

The reproduction steps use OpenSSL directly (SSL_library_init, SSL_CTX_new, SSL_CTX_set_keylog_callback, SSL_new, SSL_get_ex_new_index, SSL_set_ex_data, SSL_free, SSL_CTX_free). This does not reproduce a libcurl vulnerability; it demonstrates OpenSSL API usage that the test program itself misuses by calling the callback after free.

report_reproduction_code:0 deterministic check

Deterministic checks that failed

  • symbol SSL_get_ex_data exists in other curl releases but not at 784c17b7d98c
  • symbol SSL_get_ex_new_index exists in other curl releases but not at 784c17b7d98c
  • symbol SSL_set_ex_data exists in other curl releases but not at 784c17b7d98c

What the report says about other projects

confirmed SSL_CTX_set_keylog_callback is an OpenSSL function for logging TLS key material, called with the SSL object and a line string

“The key logging callback is called with two items: the ssl object associated with the connection, and line, a string containing the key material in the format used by NSS for its SSLKEYLOGFILE debugging output.” source

confirmed The keylog callback is invoked by OpenSSL during TLS key material generation/reception, not by the application

“This callback is called whenever TLS key material is generated or received, in order to allow applications to store this keying material for debugging purposes.” source

Read the original report (excerpt)

Full report on HackerOne ↗

Summary: A Use-After-Free (UAF) vulnerability exists in libcurl when the OpenSSL SSL_CTX_set_keylog_callback is set. The callback may be invoked after the associated SSL object has been freed via SSL_free(), leading to access to a dangling pointer and potential crash or information leak via SSL_get_ex_data(). This can be triggered manually or accidentally through custom keylog callbacks when ex_data is accessed inside the callback and the SSL object is no longer valid. Security impact: Under specific conditions (when keylog callback is configured), it results in a segmentation fault (DoS). If further heap grooming or ex_data abuse is possible, this may lead to code execution. Affected version Tested on: curl 8.8.0 (OpenSSL 3.3.0) Release-Date: 2024-06-26 Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM NTLM_WB SSL threadsafe TLS-SRP UnixSockets Platform: Termux (Android 11, aarch64) OpenSSL: 3.3.0 built from source --- Steps To Reproduce: 1. Build the following minimal C program (tested with gcc -o segv segv.c -lssl -lcrypto): #include <openssl/ssl.h> #include <openssl/err.h> #include <stdio.h> #include <stdlib.h> void my_keylog_cb(const SSL *ssl, const char *line) { printf("Keylog callback: %s\n", line); // UAF: SSL already freed void *ptr = SSL_get_ex_data((SSL *)ssl, 0); // cast to remove const printf("Data: %p\n", ptr); } int main() { SSL_library_init(); SSL_load_error_strings(); SSL_CTX *ctx = SSL_CTX_new(TLS_client_method()); SSL_CTX_set_keylog_callback(ctx, my_keylog_cb); SSL *ssl = SSL_new(ctx); int idx = SSL_get_ex_new_index(0, "mydata", NULL, NULL, NULL); char *data = strdup("hello"); SSL_set_ex_data(ssl, idx, data); SSL_free(ssl); // Free SSL // Trigger callback after free my_keylog_cb(ssl, "CLIENT_RANDOM deadbeef..."); SSL_CTX_free(ctx); free(data); return 0; } 2. Run the binary: $ ./segv Keylog callback: CLIENT_RANDOM deadbeef... Data: 0x0 Segmentation fault Was an AI involved? No, the bug was discovered through manual auditing and testing. However, AI (ChatGPT) was used only to assist in writing documentation and estimating CVSS/weakness classification (e.g., CWE-416). ## Impact Under speci …

Source code

lib/setup-vms.hlines 289–289 · definition of SSL_free
289#define SSL_free SSL_FREE
C1: Only SSL_free macro exists; SSL_get_ex_data, SSL_get_ex_new_index, SSL_set_ex_data are not present in curl at this revision per deterministic checks
C3: SSL_free is a macro (SSL_FREE) in curl
lib/setup-vms.hlines 276–276 · definition of SSL_CTX_new
276#define SSL_CTX_new SSL_CTX_NEW
C2: Only macro definitions shown; no implementation of keylog callback in provided curl source
lib/setup-vms.hlines 273–273 · definition of SSL_CTX_free
Show 1 lines (not cited by the judge)
273#define SSL_CTX_free SSL_CTX_FREE
lib/setup-vms.hlines 300–302 · definition of SSL_library_init; definition of SSL_load_error_strings; definition of SSL_new
Show 3 lines (not cited by the judge)
300#define SSL_library_init SSL_LIBRARY_INIT
301#define SSL_load_error_strings SSL_LOAD_ERROR_STRINGS
302#define SSL_new SSL_NEW
src/curlinfo.clines 243–254 · definition of main
Show 12 lines (not cited by the judge)
243int main(int argc, char **argv)
244{
245 int i;
246
247 (void) argc;
248 (void) argv;
249
250 for(i = 0; disabled[i]; i++)
251 printf("%s\n", disabled[i]);
252
253 return 0;
254}